Security audit
Security checks for vulnerabilities and agentic risk
The reporting workflow fits its purpose, but it requests an API key in chat and automatically updates external code before running it.
Review before installing. Configure the API key locally rather than pasting it into chat, and rotate any key already shared. Use a reviewed, fixed runner revision and control updates explicitly. Queries are processed by Cue, and reports receive share links, so consider confidentiality before including client information. The supplied artifacts support these concerns but do not establish malicious intent.
Authentication and Cue API access are consistent supporting implementation details, not unrelated capabilities. However, the supplied chunk stops at diagnostics and availability discovery; it never invokes the reporting capability it locates. Its implemented purpose is therefore materially narrower and different from the declared one-click report-generation workflow.
Installing a runner is a legitimate prerequisite, so repository bootstrapping alone is not a purpose mismatch. However, this workflow clones or automatically updates an unpinned external repository, including a fallback mirror, and subsequently executes its Python code with the user's permissions and access to Cue credentials. A compromised upstream repository or mirror could therefore introduce arbitrary local code execution.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
CUE_KEY=$(python3 -c "import json;print(json.load(open('$HOME/.cue/config.json'))['api_key'])" 2>/dev/null || echo "$CUE_API_KEY") echo "=== 1/3 API Key ===" && [ -n "$CUE_KEY" ] && echo "已配置" || echo "未配置！" echo "=== 2/3 Cue 服务 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/health" -H "Authorization: Bearer $CUE_KEY" echo "=== 3/3 搭子 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/playbook" -H "Authorization: Bearer $CUE_KEY" | python3 -c "import sys,json;scenes=json.load(sys.stdin).get('data',{}).get('scenes',[]);buddy=[b for s in scenes if s.get('secondary_category')=='财富投顾' for b in s.get('buddies',[]) if b.get('title')=='大类资产配置月报'];print(f'可用:{len(buddy)}个') if buddy else print('暂不可用')"
| 检查 | 预期 | 异常处理 |
The setup explicitly asks users to paste an API key into the agent conversation, unnecessarily exposing a reusable credential to chat processing, retention, and any transcript or logging integrations. The claim that the agent cannot view the key does not protect a secret supplied directly in chat; disclosure could permit unauthorized Cue usage and consumption of account credits.
The mandatory setup wording directs the agent to solicit an API key in chat, crossing a secret-handling boundary without a technical need to do so. This is the same underlying credential-exposure issue as the SQP-2 finding, not an independent compromise.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |
## 架构说明
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |
## 架构说明
L112, L160, and L179 explicitly state that the agent has no authority to view the user's API key. However, the agent-executed diagnostic at L171 directly reads api_key from ~/.cue/config.json (or CUE_API_KEY), stores it in a shell variable, and uses it in requests at L173–L174. Authentication is appropriate for this skill, and the snippet does not print the key, but its credential-access behavior conflicts with the unqualified documentation restriction.
No suspicious patterns detected.